News Evolution 1.0/2.0 Include Undefined Variable Command Execution Vulnerability

ID SSV:75861
Type seebug
Reporter Root
Modified 2014-07-01T00:00:00


No description provided by source.


News Evolution is a freely available, open source news software package. It is written in PHP, and designed for use on Unix and Linux operating systems.

The problem occurs in the aff_news.php file. By loading this file, and defining the chemin variable to an arbitrary location, commands can be executed on the local host. This vulnerability may also be used to reveal sensitive information on the local host. This same vulnerability also occurs in the export_news.php file. with with